Description

Unauthenticated Privilege Escalation in Product Catalog Enquiry for WooCommerce by MultiVendorX <= 6.1.4 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-08T08:17:12.887Z",
  "pubdate": "2026-09-08T08:17:12.887Z",
  "executiveSummary": "The Product Catalog Enquiry for WooCommerce plugin by MultiVendorX, in versions up to and including 6.1.4, contains a critical security vulnerability that allows unauthenticated attackers to perform privilege escalation.\nThis vulnerability is classified as an improper authorization flaw, enabling external actors to manipulate user roles or gain unauthorized administrative privileges within the WordPress environment.\nThe impact of this vulnerability is severe, as successful exploitation results in full site compromise, unauthorized access to sensitive vendor data, and the ability to execute administrative actions.\nThe flaw does not require prior authentication, significantly lowering the barrier for exploitation by remote, unauthenticated attackers.\nOrganizations relying on the affected versions of MultiVendorX are at high risk of malicious takeover, necessitating immediate mitigation actions to protect the integrity and confidentiality of the WooCommerce ecosystem.",
  "technicalDetails": "The vulnerability originates from a failure to implement adequate server-side authorization checks within the request handling logic of the Product Catalog Enquiry for WooCommerce plugin.\nSpecifically, the plugin fails to validate the current user's session or role permissions before processing administrative-level requests, such as those intended to modify user metadata or elevate account privileges.\nWhen an unauthenticated user sends a crafted request to the vulnerable endpoint, the application incorrectly trusts the incoming payload, assuming the sender possesses sufficient privileges to perform the requested operation.\nThe attack flow involves the crafting of an HTTP request targeting the specific plugin functionality that manages vendor or user inquiries. By manipulating parameters within the request body, an attacker can trigger internal logic that updates the user_meta or WordPress role assignments.\nBecause the plugin does not verify the authenticity of the requester, it proceeds to execute the privilege update in the backend database. This action effectively transforms the unauthenticated session into an authenticated session with administrative or high-level vendor privileges.\nThe root cause is an insecure implementation of AJAX or REST API endpoints where authorization headers and capability checks (e.g., current_user_can()) are absent or improperly configured. This permits the manipulation of sensitive user account data without requiring valid credentials or an active administrative session.\nThe scope of impact is extensive; once privilege escalation is achieved, an attacker can modify product catalogs, redirect traffic, exfiltrate customer databases, or inject malicious scripts into the front-end to facilitate further attacks on site visitors.\nThis vulnerability is present in versions <= 6.1.4. The exploitation does not rely on complex injection techniques such as SQLi, but rather on the logical bypass of access control mechanisms. The lack of nonce verification or capability scoping ensures that any remote actor with access to the web interface can successfully trigger the escalation process."
}